CVE-2014-125133: NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NativeChurch WordPress Themeto a version that resolves this vulnerability.Fixed in 1.6.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the vulnerable theme's download.php endpoint may exploit it. No credentials or user interaction are required.
What access does an attacker gain through exploitation?
An attacker can retrieve arbitrary files by supplying directory-traversal sequences in the file GET parameter. Sensitive WordPress files such as wp-config.php may be exposed.
Which installations are affected?
NativeChurch WordPress Theme versions before 1.6.2 are affected. The issue is reachable through download.php.
How can I check for exploitation attempts?
Review web-server access logs for GET requests to download.php where the file parameter contains directory-traversal sequences. Requests attempting to retrieve files such as wp-config.php are particularly suspicious.
What should be done if updating is not immediately possible?
The provided data does not specify a workaround. Restricting access to the affected download.php endpoint may reduce exposure until the theme can be updated to version 1.6.2 or later.